Machine Re-infested

XP Home SP2/eMachine


A family member's machine was infected. I removed approximately 6 Trojans, 4
unknown variants and 701 infected files using MBAM, SAS and Vipre. Before I
could erect more defenses, the family member used the machine and left it in
sleep mode for 96 hours, not letting me conclude my work. The machine is
now re-infected and those utilities are compromised. All I get are fake
scans.
I cannot get into the fire wall, user accounts or security panel. I don't
want to wipe the drive because I do not have an OS to replace XP Home SP2.

Any suggestions will be much appreciated; this is a cross post from Online
Community
--
Cordially,

Jobsdone

 

Reformat. That is your only viable option at this point .

--
Peter

Please Reply to Newsgroup for the benefit of others
Requests for assistance by email can not and will not be acknowledged.

"Jobsdone" <Jobsdone@discussions.microsoft.com> wrote in message
news:60FED352-4006-4D1D-86AE-72BA8BBB7338@microsoft.com...<!--coloro:blue--><span style="color:blue <!--/coloro-->
> XP Home SP2/eMachine
>
>
> A family member's machine was infected. I removed approximately 6 Trojans, 4
> unknown variants and 701 infected files using MBAM, SAS and Vipre. Before I
> could erect more defenses, the family member used the machine and left it in
> sleep mode for 96 hours, not letting me conclude my work. The machine is
> now re-infected and those utilities are compromised. All I get are fake
> scans.
> I cannot get into the fire wall, user accounts or security panel. I don't
> want to wipe the drive because I do not have an OS to replace XP Home SP2.
>
> Any suggestions will be much appreciated; this is a cross post from Online
> Community
> --
> Cordially,
>
> Jobsdone <!--colorc--><!--/colorc-->

 

Jobsdone wrote:<!--coloro:blue--><span style="color:blue <!--/coloro-->
> XP Home SP2/eMachine
>
>
> A family member's machine was infected. I removed approximately 6 Trojans, 4
> unknown variants and 701 infected files using MBAM, SAS and Vipre. Before I
> could erect more defenses, the family member used the machine and left it in
> sleep mode for 96 hours, not letting me conclude my work. The machine is
> now re-infected and those utilities are compromised. All I get are fake
> scans.
> I cannot get into the fire wall, user accounts or security panel. I don't
> want to wipe the drive because I do not have an OS to replace XP Home SP2.
>
> Any suggestions will be much appreciated; this is a cross post from Online
> Community<!--colorc--><!--/colorc-->

It would have been helpful to know the exact names of the malware in
your post.

Both MBAM & SAS can be downloaded and their executables can have their
filenames manually changed to something unique. It might also be good
to run GMER from:

<http://www.gmer.net/#files>

Do not download the Zip file in case your malware is looking for it.
Download the executable instead.

The renamed SAS is best run in the Safe Mode where the renamed MBAM
should be run in normal mode.

Please post an update with your progress/results.

HTH

Pete
--
1PW @?6A62?FEH9E=6o2@=]4@> [r4o7t]

 

1PW wrote:
<!--coloro:blue--><span style="color:blue <!--/coloro-->
> Jobsdone wrote:<!--coloro:green--><span style="color:green <!--/coloro-->
>> XP Home SP2/eMachine
>>
>>
>> A family member's machine was infected. I removed approximately 6
>> Trojans, 4
>> unknown variants and 701 infected files using MBAM, SAS and Vipre.
>> Before I could erect more defenses, the family member used the machine
>> and left it in
>> sleep mode for 96 hours, not letting me conclude my work. The machine
>> is
>> now re-infected and those utilities are compromised. All I get are fake
>> scans.
>> I cannot get into the fire wall, user accounts or security panel. I
>> don't want to wipe the drive because I do not have an OS to replace XP
>> Home SP2.
>>
>> Any suggestions will be much appreciated; this is a cross post from
>> Online Community<!--colorc--><!--/colorc-->
>
> It would have been helpful to know the exact names of the malware in
> your post.
>
> Both MBAM & SAS can be downloaded and their executables can have their
> filenames manually changed to something unique. It might also be good
> to run GMER from:
>
> <http://www.gmer.net/#files>
>
> Do not download the Zip file in case your malware is looking for it.
> Download the executable instead.
>
> The renamed SAS is best run in the Safe Mode where the renamed MBAM
> should be run in normal mode.
>
> Please post an update with your progress/results.<!--colorc--><!--/colorc-->

This will be useless, Pete. The only thing the OP should do at this point is
back up any data (and I would do this using a Linux Live CD and an external
hard drive instead of Windows), flatten, and clean-install.

Malke
--
MS-MVP
Elephant Boy Computers - Don't Panic!

 

Malke wrote:<!--coloro:blue--><span style="color:blue <!--/coloro-->
> 1PW wrote:
> <!--coloro:green--><span style="color:green <!--/coloro-->
>> Jobsdone wrote:<!--coloro:darkred--><span style="color:darkred <!--/coloro-->
>>> XP Home SP2/eMachine
>>>
>>>
>>> A family member's machine was infected. I removed approximately 6
>>> Trojans, 4
>>> unknown variants and 701 infected files using MBAM, SAS and Vipre.
>>> Before I could erect more defenses, the family member used the machine
>>> and left it in
>>> sleep mode for 96 hours, not letting me conclude my work. The machine
>>> is
>>> now re-infected and those utilities are compromised. All I get are fake
>>> scans.
>>> I cannot get into the fire wall, user accounts or security panel. I
>>> don't want to wipe the drive because I do not have an OS to replace XP
>>> Home SP2.
>>>
>>> Any suggestions will be much appreciated; this is a cross post from
>>> Online Community<!--colorc--><!--/colorc-->
>> It would have been helpful to know the exact names of the malware in
>> your post.
>>
>> Both MBAM & SAS can be downloaded and their executables can have their
>> filenames manually changed to something unique. It might also be good
>> to run GMER from:
>>
>> <http://www.gmer.net/#files>
>>
>> Do not download the Zip file in case your malware is looking for it.
>> Download the executable instead.
>>
>> The renamed SAS is best run in the Safe Mode where the renamed MBAM
>> should be run in normal mode.
>>
>> Please post an update with your progress/results.<!--colorc--><!--/colorc-->
>
> This will be useless, Pete. The only thing the OP should do at this point is
> back up any data (and I would do this using a Linux Live CD and an external
> hard drive instead of Windows), flatten, and clean-install.
>
> Malke<!--colorc--><!--/colorc-->

Hello Malke:

Both you and Peter may very well be right. I think it might be worth
a hour or so and a good try.

But yes, flatten and rebuild my be the only reasonable answer this time.

I hope the OP can bolster their antimalware no matter how it goes.

Regards,

Pete
--
1PW @?6A62?FEH9E=6o2@=]4@> [r4o7t]

 

Use my Remove-it software, it will remove that malware from your system.
Choose yes for all options when prompted. Download it here




--
The Real Truth
*WARNING* Do NOT follow any advice given by the people listed below.
They do NOT have the expertise or knowledge to fix your issue. Do not waste
your time.
David H Lipman, Malke, PA Bear, Beauregard T. Shagnasty, Leythos.




"Jobsdone" <Jobsdone@discussions.microsoft.com> wrote in message
news:60FED352-4006-4D1D-86AE-72BA8BBB7338@microsoft.com...<!--coloro:blue--><span style="color:blue <!--/coloro-->
> XP Home SP2/eMachine
>
>
> A family member's machine was infected. I removed approximately 6
> Trojans, 4
> unknown variants and 701 infected files using MBAM, SAS and Vipre. Before
> I
> could erect more defenses, the family member used the machine and left it
> in
> sleep mode for 96 hours, not letting me conclude my work. The machine is
> now re-infected and those utilities are compromised. All I get are fake
> scans.
> I cannot get into the fire wall, user accounts or security panel. I don't
> want to wipe the drive because I do not have an OS to replace XP Home SP2.
>
> Any suggestions will be much appreciated; this is a cross post from Online
> Community
> --
> Cordially,
>
> Jobsdone <!--colorc--><!--/colorc-->

 

Jobsdone wrote:<!--coloro:blue--><span style="color:blue <!--/coloro-->
> XP Home SP2/eMachine
>
>
> A family member's machine was infected. I removed approximately 6 Trojans, 4
> unknown variants and 701 infected files using MBAM, SAS and Vipre. Before I
> could erect more defenses, the family member used the machine and left it in
> sleep mode for 96 hours, not letting me conclude my work. The machine is
> now re-infected and those utilities are compromised. All I get are fake
> scans.
> I cannot get into the fire wall, user accounts or security panel. I don't
> want to wipe the drive because I do not have an OS to replace XP Home SP2.
>
> Any suggestions will be much appreciated; this is a cross post from Online
> Community<!--colorc--><!--/colorc-->

Also, if you're smart, you'll stay away from the thief/liar TRT and
his stolen offerings.

--
1PW @?6A62?FEH9E=6o2@=]4@> [r4o7t]

 

"The Real Truth MVP" <trt@void.com> wrote in message
news:f6SdnamSGoLE1ePXnZ2dnUVZ_vmdnZ2d@giganews.com...<!--coloro:blue--><span style="color:blue <!--/coloro-->
> Use my Remove-it software, it will remove that malware from your system.
> Choose yes for all options when prompted. Download it here
>
><!--colorc--><!--/colorc-->
<SNIPPAGE>

Christopher...is that picture on your website the same picture on this
website: ? I didn't know you had TWO
websites.

 

On Sun, 09 Aug 2009 09:44:24 -0400, ---Fitz--- <---fitz---@invalid.com>
wrote:
<!--coloro:blue--><span style="color:blue <!--/coloro-->
> "The Real Truth MVP" <trt@void.com> wrote in message
> news:f6SdnamSGoLE1ePXnZ2dnUVZ_vmdnZ2d@giganews.com...<!--coloro:green--><span style="color:green <!--/coloro-->
>> Use my Remove-it software, it will remove that malware from your
>> system. Choose yes for all options when prompted. Download it here
>>
>><!--colorc--><!--/colorc-->
> <SNIPPAGE>
>
> Christopher...is that picture on your website the same picture on this
> website: ? I didn't know you had TWO
> websites.<!--colorc--><!--/colorc-->

I didn't know its name was sara! I wonder if that site is where it stole
the picture from.
--
Using Opera's revolutionary e-mail client:

 

Fitz

The Real Truth MVP is a thief and a liar. He also is NOT an MVP. Using his link will
get you infected and also might take you to P0rn pages. Do not touch his link and if
you did then check for Virus,Malware and Trojan

--
Peter

Please Reply to Newsgroup for the benefit of others
Requests for assistance by email can not and will not be acknowledged.

"---Fitz---" <---fitz---@invalid.com> wrote in message
news:OYKEGePGKHA.2832@TK2MSFTNGP03.phx.gbl...<!--coloro:blue--><span style="color:blue <!--/coloro-->
> "The Real Truth MVP" <trt@void.com> wrote in message
> news:f6SdnamSGoLE1ePXnZ2dnUVZ_vmdnZ2d@giganews.com...<!--coloro:green--><span style="color:green <!--/coloro-->
>> Use my Remove-it software, it will remove that malware from your system. Choose
>> yes for all options when prompted. Download it here
>><!--colorc--><!--/colorc-->
> <SNIPPAGE>
>
> Christopher...is that picture on your website the same picture on this website:
> ? I didn't know you had TWO websites. <!--colorc--><!--/colorc-->

 

"Max Wachtel" <maxpro4u@hotmail.com> wrote in message
newsp.uyex6xpbxavyrp@max...<!--coloro:blue--><span style="color:blue <!--/coloro-->
> On Sun, 09 Aug 2009 09:44:24 -0400, ---Fitz--- <---fitz---@invalid.com>
> wrote:
><!--coloro:green--><span style="color:green <!--/coloro-->
>> "The Real Truth MVP" <trt@void.com> wrote in message
>> news:f6SdnamSGoLE1ePXnZ2dnUVZ_vmdnZ2d@giganews.com...<!--coloro:darkred--><span style="color:darkred <!--/coloro-->
>>> Use my Remove-it software, it will remove that malware from your
>>> system. Choose yes for all options when prompted. Download it here
>>>
>>><!--colorc--><!--/colorc-->
>> <SNIPPAGE>
>>
>> Christopher...is that picture on your website the same picture on this
>> website: ? I didn't know you had TWO
>> websites.<!--colorc--><!--/colorc-->
>
> I didn't know its name was sara! I wonder if that site is where it stole
> the picture from.
> --
> Using Opera's revolutionary e-mail client: <!--colorc--><!--/colorc-->


I thought his name was Christopher too. I had no idea he was really Sara.
Naw. Can't be. Christopher isn't a thief...is he? Gosh...well lemme think
about that...YEP...I guess he is. Apparently he also has a gender
identification problem as well as being a loon. I've seen his filth and
he's an expert at it. Must come from experience. So sad. Sara was so nice
looking.

 

In article <f6SdnamSGoLE1ePXnZ2dnUVZ_vmdnZ2d@giganews.com>, trt@void.com
says...<!--coloro:blue--><span style="color:blue <!--/coloro-->
> Use my Remove-it software, it will remove that malware from your system.
> Choose yes for all options when prompted. Download it here
> <!--colorc--><!--/colorc-->

PCBUTTS1, you've exposed yourself as the PIRATE/THIEF we all have said
you are.

The file you claim to have known about, claim to have submitted to anti-
virus sites, the file named "obatssrsghde.exe" was a marker inserted
into Stuarts batch file you stole from him, it was a KEY that proves
you're a thief:

For those that don't know, Stuart inserted the obatssrsghde.exe marker
into his batch file to prove, to the community, that PCBUTTS1 / The Real
Truth MVP is actually a lying thief, and PCBUTTS admitted in his own
post that he created the marker and claimed to know what it was - even
claimed to have submitted the malware to anti-virus vendors, but the
joke was on him, Stuart told everyone in the community about it BEFORE
it appeared in PCBUTTS1 download.... There is no actual file named
obatssrsghde.exe in the malware community, it was a ruse.

The key is in the spelling (shifted one character):

obatssrsghde.exe
pcbuttsthief

If you change (add) 1 character to each letter you will see that
"obatssrsghde" is actually the marker "pcbuttsthief" - proving that
PCBUTTS1 is a thief.

Are there other markers - YES, does PCBUTTS1 know about them - no,
they've been there for a long time, but this is the most obvious one.

Face it Chris/PCBUTTS1/TRT, you've exposed yourself in public.

--
You can't trust your best friends, your five senses, only the little
voice inside you that most civilians don't even hear -- Listen to that.
Trust yourself.
spam999free@rrohio.com (remove 999 for proper email address)

 

"---Fitz---" <---fitz---@invalid.com> wrote in
news:#IqSXpWGKHA.4732@TK2MSFTNGP04.phx.gbl:
<!--coloro:blue--><span style="color:blue <!--/coloro--><!--coloro:green--><span style="color:green <!--/coloro--><!--coloro:darkred--><span style="color:darkred <!--/coloro-->
>>> <SNIPPAGE><!--colorc--><!--/colorc--><!--colorc--><!--/colorc-->
>
> I thought his name was Christopher too. I had no idea he was
> really Sara. Naw. Can't be. Christopher isn't a thief...is he?
> Gosh...well lemme think about that...YEP...I guess he is.
> Apparently he also has a gender identification problem as well as
> being a loon. I've seen his filth and he's an expert at it. Must
> come from experience. So sad. Sara was so nice looking.
> <!--colorc--><!--/colorc-->

Sara would never post the filth that PC does

 

Peter, 1PW,
thanks for your suggestions. Before flattening, I will
give them a serious try. The vendor no longer issues recovery disks for this
machine. I will be sure to let everyone know.
The ongoing snippage is doing this discussion much
harm, especially for newbies and those not familiar with the MSFT discussion
groups. Find a way to cease this bickering.
--
Cordially,

Jobsdone


"1PW" wrote:
<!--coloro:blue--><span style="color:blue <!--/coloro-->
> Jobsdone wrote:<!--coloro:green--><span style="color:green <!--/coloro-->
> > XP Home SP2/eMachine
> >
> >
> > A family member's machine was infected. I removed approximately 6 Trojans, 4
> > unknown variants and 701 infected files using MBAM, SAS and Vipre. Before I
> > could erect more defenses, the family member used the machine and left it in
> > sleep mode for 96 hours, not letting me conclude my work. The machine is
> > now re-infected and those utilities are compromised. All I get are fake
> > scans.
> > I cannot get into the fire wall, user accounts or security panel. I don't
> > want to wipe the drive because I do not have an OS to replace XP Home SP2.
> >
> > Any suggestions will be much appreciated; this is a cross post from Online
> > Community<!--colorc--><!--/colorc-->
>
> It would have been helpful to know the exact names of the malware in
> your post.
>
> Both MBAM & SAS can be downloaded and their executables can have their
> filenames manually changed to something unique. It might also be good
> to run GMER from:
>
> <http://www.gmer.net/#files>
>
> Do not download the Zip file in case your malware is looking for it.
> Download the executable instead.
>
> The renamed SAS is best run in the Safe Mode where the renamed MBAM
> should be run in normal mode.
>
> Please post an update with your progress/results.
>
> HTH
>
> Pete
> --
> 1PW @?6A62?FEH9E=6o2@=]4@> [r4o7t]
> <!--colorc--><!--/colorc-->

 

One more thing, what's the exe on SAS and MBAM respectively (there're so
many files in each with no clear delineation)
--
Cordially,

Jobsdone


"Peter Foldes" wrote:
<!--coloro:blue--><span style="color:blue <!--/coloro-->
> Fitz
>
> The Real Truth MVP is a thief and a liar. He also is NOT an MVP. Using his link will
> get you infected and also might take you to P0rn pages. Do not touch his link and if
> you did then check for Virus,Malware and Trojan
>
> --
> Peter
>
> Please Reply to Newsgroup for the benefit of others
> Requests for assistance by email can not and will not be acknowledged.
>
> "---Fitz---" <---fitz---@invalid.com> wrote in message
> news:OYKEGePGKHA.2832@TK2MSFTNGP03.phx.gbl...<!--coloro:green--><span style="color:green <!--/coloro-->
> > "The Real Truth MVP" <trt@void.com> wrote in message
> > news:f6SdnamSGoLE1ePXnZ2dnUVZ_vmdnZ2d@giganews.com...<!--coloro:darkred--><span style="color:darkred <!--/coloro-->
> >> Use my Remove-it software, it will remove that malware from your system. Choose
> >> yes for all options when prompted. Download it here
> >><!--colorc--><!--/colorc-->
> > <SNIPPAGE>
> >
> > Christopher...is that picture on your website the same picture on this website:
> > ? I didn't know you had TWO websites. <!--colorc--><!--/colorc-->
>
> <!--colorc--><!--/colorc-->

 

Huh ?

What is so many files. There is only a single download directly from the link for
both SAS and MBAM

I would not worry about those at present. Flatten and reformat your OS. Too many
infectors from what you have posted for you to be able to save the system

--
Peter

Please Reply to Newsgroup for the benefit of others
Requests for assistance by email can not and will not be acknowledged.

"Jobsdone" <Jobsdone@discussions.microsoft.com> wrote in message
news:3F217560-1A1A-45A2-9D0B-A72CC7EF6EEF@microsoft.com...<!--coloro:blue--><span style="color:blue <!--/coloro-->
> One more thing, what's the exe on SAS and MBAM respectively (there're so
> many files in each with no clear delineation)
> --
> Cordially,
>
> Jobsdone
>
>
> "Peter Foldes" wrote:
><!--coloro:green--><span style="color:green <!--/coloro-->
>> Fitz
>>
>> The Real Truth MVP is a thief and a liar. He also is NOT an MVP. Using his link
>> will
>> get you infected and also might take you to P0rn pages. Do not touch his link and
>> if
>> you did then check for Virus,Malware and Trojan
>>
>> --
>> Peter
>>
>> Please Reply to Newsgroup for the benefit of others
>> Requests for assistance by email can not and will not be acknowledged.
>>
>> "---Fitz---" <---fitz---@invalid.com> wrote in message
>> news:OYKEGePGKHA.2832@TK2MSFTNGP03.phx.gbl...<!--coloro:darkred--><span style="color:darkred <!--/coloro-->
>> > "The Real Truth MVP" <trt@void.com> wrote in message
>> > news:f6SdnamSGoLE1ePXnZ2dnUVZ_vmdnZ2d@giganews.com...
>> >> Use my Remove-it software, it will remove that malware from your system.
>> >> Choose
>> >> yes for all options when prompted. Download it here
>> >>
>> > <SNIPPAGE>
>> >
>> > Christopher...is that picture on your website the same picture on this website:
>> > ? I didn't know you had TWO websites.<!--colorc--><!--/colorc-->
>>
>> <!--colorc--><!--/colorc--><!--colorc--><!--/colorc-->

 

It's a shame the post got so far with no clear solution. If I were you
Jobsdone, I would boot into SAFE MODE, download MBAM and SAS if you need to,
update them, and run full scans there. That should get you to a point when
you can boot into windows in normal mode and continue cleaning the system.
If not, you may want to try restoring the system to before the family member
reinfected the computer. Hope this gets to you before you format.

Good Luck
"Jobsdone" <Jobsdone@discussions.microsoft.com> wrote in message
news:60FED352-4006-4D1D-86AE-72BA8BBB7338@microsoft.com...<!--coloro:blue--><span style="color:blue <!--/coloro-->
> XP Home SP2/eMachine
>
>
> A family member's machine was infected. I removed approximately 6
> Trojans, 4
> unknown variants and 701 infected files using MBAM, SAS and Vipre. Before
> I
> could erect more defenses, the family member used the machine and left it
> in
> sleep mode for 96 hours, not letting me conclude my work. The machine is
> now re-infected and those utilities are compromised. All I get are fake
> scans.
> I cannot get into the fire wall, user accounts or security panel. I don't
> want to wipe the drive because I do not have an OS to replace XP Home SP2.
>
> Any suggestions will be much appreciated; this is a cross post from Online
> Community
> --
> Cordially,
>
> Jobsdone <!--colorc--><!--/colorc-->

 

From: "Brent" <somebody@somewhere.com>

| It's a shame the post got so far with no clear solution. If I were you
| Jobsdone, I would boot into SAFE MODE, download MBAM and SAS if you need to,
| update them, and run full scans there. That should get you to a point when
| you can boot into windows in normal mode and continue cleaning the system.
| If not, you may want to try restoring the system to before the family member
| reinfected the computer. Hope this gets to you before you format.

It is contraindicated to run MBAM in Safe Mode.

Additionally, while Safe Mode is a lighter verion of the OS it is still no guarantee that
the malware witll not be loaded and react the same way as in Normal Mode.


--
Dave

Multi-AV -

 

Whether or not running MBAM in safe mode or normal is the better option, can
lead to a lifetime back and forth discussion. MBAM is not the only program I
would suggest him to run, SAS and Spybot can also run in safemode. But I
agree that the system may be TOO infected to clean it. But I rather avoid
him having to format the computer off the bat. At least he has a chance in
safe mode to clean enough to start in normal mode and further clean the
computer or backup and THEN format.

"David H. Lipman" <DLipman~nospam~@Verizon.Net> wrote in message
news:u%23vWVWFHKHA.3928@TK2MSFTNGP04.phx.gbl...<!--coloro:blue--><span style="color:blue <!--/coloro-->
> From: "Brent" <somebody@somewhere.com>
>
> | It's a shame the post got so far with no clear solution. If I were you
> | Jobsdone, I would boot into SAFE MODE, download MBAM and SAS if you need
> to,
> | update them, and run full scans there. That should get you to a point
> when
> | you can boot into windows in normal mode and continue cleaning the
> system.
> | If not, you may want to try restoring the system to before the family
> member
> | reinfected the computer. Hope this gets to you before you format.
>
> It is contraindicated to run MBAM in Safe Mode.
>
> Additionally, while Safe Mode is a lighter verion of the OS it is still no
> guarantee that
> the malware witll not be loaded and react the same way as in Normal Mode.
>
>
> --
> Dave
>
> Multi-AV -
>
> <!--colorc--><!--/colorc-->

 

"Brent" <somebody@somewhere.com> wrote in message
news:ebWbaPOHKHA.4004@TK2MSFTNGP05.phx.gbl...<!--coloro:blue--><span style="color:blue <!--/coloro-->
> Whether or not running MBAM in safe mode or normal is the better
> option, can lead to a lifetime back and forth discussion.<!--colorc--><!--/colorc-->

Not once you consider how it is designed to work.